View Single Post
  #5  
Old 10-22-2010, 01:39 PM
  dziner08's Avatar 
dziner08 dziner08 is offline
 

Newbie
  
Join Date: Mar 2008
Posts: 8
 

Default Re: Add Customer Location and Date/Time Stamp to Customer Reviews

Sorry to bump an old thread, but I thought I should bring up a slight vulnerability in your code. The Location Field is not being escaped for html input, which could lead to all sorts of havoc if your reviews are not moderated.

To fix this, Search for
Code:
$review_message = htmlspecialchars(trim($review_message));
And replace it with
Code:
$review_message = htmlspecialchars(trim($review_message)); $review_location = htmlspecialchars(trim($review_location));

Thanks for sharing your code, and I hope my modification can save some people from a potential headache. The internet can be a dangerous place.
__________________
X-Cart 4.1.9
Reply With Quote